i love condos[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

i love condos.exe
Size

5.3MB
MD5

69544d9b56d09fe4423024adbb5d41b8
SHA1

2fe155d8686c6e0a6fd2b5a52a21c2a156751d8e
SHA256

f45beebdfaa3d27d21d0438710197dd40b8d46b72109bdc5cd9cdc324f058d33
SHA512

f638d4e06a5a03ebc489ca95d65feefd87a8f64326f3d6ad852cfec756ba35b765a4c1b22e1fc7ca7f0ee19a8f348ffbe8e697fc0d959f325faa7d22889030c1
SSDEEP

49152:VIlxgYkgbKnP3MNTvJseI+t7zpTuF241gzOMVgafOOcLensxXmyBYUbN5HIjnwqU:kqiPidiYW3Ha

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
i love condos.exe

Files

i love condos.exe
.exe windows:6 windows x64 arch:x64

Password: penis

cd1f9b959dd8de69a6fce7193d8fc83c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

untitled.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

kernel32

IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
SetHandleInformation
CloseHandle
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentProcess
GetStdHandle
GetCurrentProcessId
QueryPerformanceFrequency
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
GetFinalPathNameByHandleW
GetConsoleMode
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetModuleHandleA
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentThreadId
GetSystemTimeAsFileTime

ole32

CoInitializeEx
CoUninitialize

shell32

ShellExecuteW

user32

OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData

secur32

DeleteSecurityContext
DecryptMessage
FreeCredentialsHandle
EncryptMessage
InitializeSecurityContextW
FreeContextBuffer
AcceptSecurityContext
ApplyControlToken
AcquireCredentialsHandleA
QueryContextAttributesW

crypt32

CertOpenStore
CertCloseStore
CertFreeCertificateChain
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateStore
CertFreeCertificateContext
CertDuplicateCertificateContext

ws2_32

WSASend
send
shutdown
getpeername
getsockname
connect
bind
WSASocketW
closesocket
WSAIoctl
getsockopt
setsockopt
ioctlsocket
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
recv

ntdll

NtReadFile
NtCreateFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile

vcruntime140

memset
__current_exception_context
__current_exception
memcmp
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_seh_filter_exe
__p___argc
_initialize_narrow_environment
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_set_app_type
terminate
_get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 285KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: penis

cd1f9b959dd8de69a6fce7193d8fc83c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

kernel32

ole32

shell32

user32

secur32

crypt32

ws2_32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 285KB - Virtual size: 284KB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 285KB - Virtual size: 284KB

.reloc
Size: 23KB - Virtual size: 23KB